daemon: relayed trust handshakes complete in seconds instead of two minutes

[TeoSlayer]

Pull Request

Summary

Trust between two private nodes took about two minutes. A requester cannot resolve a private node before trust exists, so the handshake is relayed through the registry, and each side only found the relayed message in handshakePollLoop, which ticks every 60 seconds: ~57s for the request to reach the target, ~59s for the approval to come back. The direct path (to a public node) was already instant.

Changes

1. The requester polls quickly only while it is waiting. After a handshake request is sent, poll every 2s until the peer answers or becomes trusted, for at most 2 minutes. One extra timer in the existing loop; no goroutine per request.
2. Poll on demand. pending, trust, approve, reject and wait-for-trust check the registry first, at most once per 2s (3s bound if the registry is slow), so an operator asking "anything pending?" sees a relayed request at once.
3. Handle the beacon's notify. A two-byte [0x0A][0x01] from the beacon's address triggers a poll. It needs beacon: NotifyNode tells a node the registry holds a relayed handshake for it beacon#59 and registry: tell the beacon which node a relayed handshake was parked for rendezvous#129 on the server side; without them nothing sends it.

Load

The 60-second baseline is unchanged: two idle nodes made 32 registry requests in 240s before and after. Worst-case handshake polls per node per minute (today: 1):

State	Polls/min
Idle	1
Waiting on a request it sent	up to 31, for at most 2 minutes
Local client hammering pending	at most 31
Flood of notifies	at most 16 in the first minute, then 13
All at once	about 31 — every trigger shares one gate

A notify never triggers a poll sooner than 2s after the previous one (deferred, not dropped). Automatic, dial-driven handshakes cannot restart the fast window for the same peer within 10 minutes.

Measured (Docker, private requester and target, manual approval)

Requester / target / servers	Request at target	Approval at requester	First message
old / old / old	57.2s	59.5s	117.0s
new / new / new	0.1s	0.0s	0.4s
new / new / old servers	54.4s	0.0s	54.6s
new / new / old servers, operator runs pending	0.1s	0.0s	0.3s
old requester / new target / new servers	0.1s	57.5s	57.8s
new requester / old target / new servers	54.3s	0.0s	54.6s

The un-updated side keeps working at the old pace in every mix. Baseline approval time is either ~57s or near zero depending on how the two nodes' 60s ticks fall.

Notes for review

• Two existing tests were changed (separate commit): TestHandshakeTrustPersistence and TestHandshakeTrustLoadVerify read trust.json the instant the peer appears in the trusted list, but the handshake plugin writes the file just after. The new poll-before-listing made that gap show every time; the tests now wait up to 2s for the file. Product behaviour is unchanged.
• The notify is trusted by source address, like punch commands. Someone who can spoof the beacon's address gains only the rate-limited polls.
• TestRelayedHandshakeReachesUnattendedTarget skips until the beacon and rendezvous modules are bumped to releases with the notify.
• Not tested: multiple beacons, and the compat (WSS) transport; both fall back to polling.

Test Plan

• go build ./..., go vet ./..., unit suite with GOWORK=off
• Scheduler unit tests on an injected clock; TestBeaconNotifyOnlyFromBeacon; TestRelayedHandshakeCompletesInSeconds (fails on main: "relayed request not in the target's pending list after 20s")
• Full go test -parallel 4 -count=1 ./tests/: one failure, TestManualSnapshotTrigger, which binds fixed port 127.0.0.1:18080 held by another process on the test machine

Checklist

• New code includes the SPDX license header
• go.mod / go.sum unchanged
• CHANGELOG updated

🤖 Generated with Claude Code

[TeoSlayer]

Rebased onto current main (CHANGELOG conflict only, both sides kept). Build, vet and the unit suite pass after the rebase; the handshake integration tests pass. The full integration suite was not re-run after the rebase.